©2011 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice

Jason Jones, HP DVLabs

The State of Web Exploit Kits

Who Am I?

•  Team Lead, ASI •  Malware Analysis •  IP Reputation •  Malicious content harvesting

2

What Are Web Exploit Kits?

Web Exploit Kits Are…

4

Pre-packaged software that consists of •  Installers (usually) •  Typically PHP-based •  Number of Exploits

•  Rarely 0-day •  Control Panel

•  Installer •  Statistics •  Configuration

•  Install malicious payload •  Botnet •  Trojan •  Fake AV

Exploit Kit Economy

5

•  Cost up to thousands of dollars •  Rentals also offered on daily/weekly/monthly basis •  Bullet-proof hosting options •  Contain “EULA”-like agreements •  Marketing & competitiveness between kits •  Regularly issue updates

– Bug-fixes – Exploit reliability updates – Aesthetic changes

Active Exploit Kits

6

* Image courtesy of Kahu Security

How Exploit Kits Typically Work

7

Black Hole Exploit Kit

What is Black Hole Exploit Kit?

9

•  Launched in late 2010 •  Currently most popular exploit kit •  Version 1.2.3 •  Contains many recent Java exploits •  Contains exploit for CVE-2012-1889 (MS XML)

– 0-day at the time

•  Good JavaScript obfuscation

Black Hole in the News

10 Enterprise Security – HP Confidential

Black Hole Events in 2011

11

Black Hole Spam Campaigns

12

•  Spam is easy •  Target users with

– Fake delivery notices – Fake IRS notices – Fake orders from online retailers

•  User clicks the link – Owned!

Black Hole Control Panel

13

*Image courtesy of Xylit0l

Black Hole Control Panel (cont.)

14

*Image courtesy of Xylit0l

83%!?!??!

15

Black Hole Control Panel (cont.)

16

*Image courtesy of Xylit0l

Black Hole Exploit URL Schemes

17

•  Predictable •  Typically ending in .php

– Main.php and showthread.php most common

•  One URL parameter – Normally 1-5 characters – Value is 16 valid hex characters

•  Malware payload URL normally w.php – 3 parameters

Black Hole JavaScript Obfuscation

18

•  Changes a lot •  Typically consists of

– Text blob in HTML tag or parameter – Deobfuscation routine

•  Loads malicious iFrame for bulletproof site – More obfuscated JavaScript – Detects browser/plugin versions – Launches exploit to load malware

Black Hole JavaScript Obfuscation (cont.)

19

Black Hole PDF Obfuscation

20

•  Slightly different obfuscation than JavaScript •  ASCII Character replacement

– &#00097 for “a” – Still uses giant text blobs – Characters separated by ‘@@@’

•  Once deobfuscated follows the same pattern as JavaScript in HTML

Black Hole JavaScript Shellcode

21

•  Most exhibits the same behavior – Standard JMP / CALL to obtain address – Patches bytes of shellcode using XOR with 0x28 – VOILA! Junk ASM code now valid – URL now visible near the end of the shellcode – Easily detected by many shellcode detection libs

Black Hole JavaScript Shellcode (cont.)

22

Phoenix Exploit Kit

Phoenix Exploit Kit History

24

•  Started in 2007 •  Current version 3.1 •  Offers full and mini versions

– Mini version only allows one affiliate – Full allows for multiple

•  Tracks visitors, only launches exploit once per IP •  Large number of exploits available

Phoenix Exploit Kit Statistics

25

*Image courtesy of Xylit0l

Phoenix Exploit Kit Exploit Statistics

26

*Image courtesy of Xylit0l

PEK JavaScript Obfuscation

27

•  Uses multiple <script> tags – 2 <script> tags – <textarea> tag – Final <script> tag

•  Deobfuscated code still not obvious •  No

–  “getShellcode” routine –  “heap spray” references

PEK Obfuscated JavaScript

28

PEK PDF Obfuscation

29

•  Resembles Black Hole JS obfuscation •  Large array of integers •  Run through deobfuscation routine, launch exploit •  Deobfuscation routine simpler than Black Hole

Other Exploit Kits

Lots of New Kits

31

•  Large number of new kits in 2012 •  Multiple kits have popped up from China •  Many more popping up from Eastern Europe •  Some kits pop-up and then disappear •  Too many to keep up with!

Yang Pack

32

•  Surfaced in late 2011 / early 2012 •  Based out of China •  3 exploits, very low detection rates •  Like many kits from China

– No PHP files – No database backend – Consist only of static HTML files

Sweet Orange Exploit Kit

33

•  Surfaced in 2012 •  Aims to keep small footprint •  Authors only give information to established

cybercriminals •  Costs $2500 •  Rents for $1400 •  Observed in the wild?

Sweet Orange Exploit Kit (cont.)

34

*Image courtesy of Webroot / Dancho Danchev

Sweet Orange Exploit Kit (cont.)

35

*Image courtesy of Webroot / Dancho Danchev

Nuclear Pack v2

36

• Been dormant for a few years • Resurfaced in 2012 with 4 exploits •  Introduced anti-honeyclient feature

– Difficult to automate collection of exploits – More interactive honeyclients/sandbox required

Nuclear Pack Anti-Crawling

37

Conclusion

• Exploit kits are only getting more sophisticated – Newer exploits – Changing evasions / obfuscations – This is a business for the authors, they are invested in staying one-step ahead to make money

• Detecting new techniques takes work • Patch Java!

38

Many Thanks to…

• Marc Eisenbarth, Joanna Burkey • Alen Puzic, Mike Dausin, Jen Lake •  Jorge Mieres, Steven K/Xylit0l, Mila, Dancho Danchev, SpiderLabs guys, Kahu Security

39

THANK YOU

QUESTIONS?